CVE-2026-12573

{
  "etk_id": "ETK-2026-4051",
  "cve_id": "CVE-2026-12573",
  "display_id": "CVE-2026-12573",
  "ghsa_id": "GHSA-jp8g-g3px-gw9c",
  "euvd_id": "EUVD-2026-120880",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cisco IOS command injection in DDI Central",
  "summary": "DDI Central build 6200 and earlier improperly handles DHCP pool names when managing Cisco routers. An authenticated attacker may cause commands to run on managed Cisco devices through this input.",
  "mitigation": "Upgrade DDI Central to build 6201 or later. Until upgraded, restrict access to authenticated DDI Central administration functions and limit management connectivity to Cisco routers.",
  "vendor": "Zohocorp",
  "product": "DDI Central",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 6201"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "6201"
      ],
      "package_name": "DDI Central",
      "purl": null
    }
  ],
  "cwes": [
    77
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 60.73080301666667,
  "t0_at": "2026-11-10T11:22:34.589000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-10T11:22:34.589000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-10T11:22:34.589000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12573"
    }
  }
}